CODEWITHSUNDEEP
firewalliptables
Sven Hager
Sven Hager

Reputation: 3194

Jumps in firewall rule sets

I have a general question regarding software-based firewalls. Specifically, I would like to know whether there are other firewalls than iptables which allow the specification of jumps inside of the rule set.

In iptables, users have the possibility to specify "jumps" inside of the rule set by targeting specific chains when a rule matches on a packet.

For example, in the following rule set

(1) iptables -A INPUT --src 1.2.3.4 -j ACCEPT
(2) iptables -A INPUT --src 1.2.3.5 -j ACCEPT
(3) iptables -A INPUT --src 1.2.3.6 -j ACCEPT
(4) iptables -A INPUT --src 8.8.8.8 -j NEXT_CHAIN
(5) iptables -A INPUT --src 2.2.2.2 -j ACCEPT
(6) iptables -A INPUT --src 2.2.2.3 -j ACCEPT

<NEXT_CHAIN starts here ...>

rule (4) redirects packet processing to another rule set named "NEXT_CHAIN". In other words, rules (5) and (6) are skipped (in some sense, if there is a match in NEXT_CHAIN). I think this is also possible in iptables' predecessor ipchains.

Do you know whether there are any other firewalls that provide a similar feature?

Upvotes: 0

Views: 1248

Answers (3)

Sven Hager
Sven Hager

Reputation: 3194

I did some research on other packet filtering systems, and I found out the following:

  • OpenBSD's pf can implement some sort of control using conditional anchors:

    EXAMPLE: anchor udp-only in on fxp0 inet proto udp

  • The OpenFlow switch provides direct jumps by using GOTO targets
  • NetBSD's ipfw provides the skipto action

Each of these features allows to modify the control flow during packet classification and can be used to implement JUMP semantics.

Upvotes: 0

Pat
Pat

Reputation: 2700

Linux firewalls are built around Netfilter; the kernel's network packet processing framework which is made of several kernel modules performing specific tasks like:

  1. The FILTER module (always loaded by default) mainly allows us to ACCEPT or DROP IP packets based on a certain matching criteria.

  2. The NAT module set allows us to perform Network Address Translations (SNAT, DNAT, MASQUERADE).

  3. The MANGLE module allows us to alter certain IP packet fields (TOS, TTL)

Users configure the Netfilter framework ("kernel mode") to suit their firewall needs using iptables which is an "userland" application run from the command line. With iptables we define rules that instruct the Linux kernel what to do with IP packets when they arrive into, pass through, or leave our Linux box.

All the Linux based firewalls are based in Netfilter and most of them use iptables as a way to control Netfilter.

Different technologies use a similar strategy; i.e. in BSD (OpenBSD) the kernel module is called PF (Packet Filter) an the "userland" application for controlling PF is called pfctl

Depending what technology you use you have one or the other; both systems do basically the same and of course they both can perform the jumps you mention. Remember a firewall in Linux or BSD is just a set of rules loaded by the corresponding userland application which set the behavior of the corresponding net traffic control kernel engine.

also consider when you jump into a user defined chain you can also "return"

enter image description here

Upvotes: 1

Jiminion
Jiminion

Reputation: 5168

The other main competitor to iptables is pf, which has similar capabilities to iptables.

Upvotes: 1

Related Questions